EIP-7702 Delegation Exploit Drains sven.eth Wallet of $22.7K

On October 14, 2026, an attacker used a pre-signed EIP-7702 authorization to delegate execution of the victim's Ethereum EOA to a malicious contract and sweep 9.1231 ETH plus TAPEETH tokens. The attack exploits EIP-7702's sponsored-transaction model, which lets any relayer include a pre-signed delegation and act in the context of the victim's address.

Root cause

EIP-7702, activated in Ethereum's Pectra upgrade, lets an externally owned account (EOA) sign an authorization tuple that temporarily delegates code execution to a designated contract. Critically, the delegation does not expire automatically and can be replayed by any relayer inside a sponsored (type 4) transaction — without the victim paying gas or being online.

In this incident the victim had previously signed an EIP-7702 authorization pointing to an attacker-deployed contract. The attacker bundled that signed authorization into a sponsored transaction, which caused the victim's EOA to execute the malicious contract's code and transfer its balance to the attacker.

// Simplified malicious delegate contract
contract MaliciousDelegate {
    address immutable attacker;
    constructor(address _a) { attacker = _a; }
    // Called in the context of the delegating EOA
    fallback() external payable {
        payable(attacker).transfer(address(this).balance);
        // Also sweeps pre-approved ERC-20 tokens via transferFrom
    }
}

Attack steps

Step	Action
1	Attacker deploys `MaliciousDelegate` contract pointing to attacker-controlled address
2	Victim is social-engineered (phishing dApp or signed message) into signing an EIP-7702 authorization tuple for `MaliciousDelegate`
3	Attacker submits a `type 4` sponsored transaction containing the victim's signed authorization
4	EVM applies delegation: victim's EOA now executes `MaliciousDelegate` code for this tx
5	Contract sweeps 9.1231 ETH and 1.69 TAPEETH to attacker (~$22,770 USD)
6	Delegation remains active post-drain — all future deposits to the address are at risk until the victim revokes by re-signing with a null delegate

Impact

Wallet: sven.eth (Ethereum ENS)
Chain: Ethereum mainnet
Loss: ~9.1231 ETH + 1.69 TAPEETH ≈ $22,770 USD
Block height at detection: 26,188,153 (ExVul)
Delegation status: Active post-drain — future deposits at risk
No DeFi protocol breached — the victim's own wallet was the attack surface

Lessons for auditors

EIP-7702 authorizations are persistent and transferable. Unlike ERC-20 approvals which many users understand to revoke, delegation authorizations are invisible in most wallet UIs. Audit any dApp that requests eth_signAuthorization for a clear revocation UX.
Sponsored transactions remove the attacker's gas dependency. A victim with zero ETH is still fully drainable once a delegation is planted.
Phishing surface expanded dramatically. Any off-chain signature request (eth_signAuthorization) can plant a delegation time-bomb. Auditors should check dApp front-ends for malicious injection of authorization prompts.
Pattern is reproducible at scale. Wintermute research showed >97% of all EIP-7702 delegations on Ethereum share the same code hash — a single attacker contract can be pre-positioned to target many victims.
Revocation path must be explicit. Re-signing with a null (0x0000…) delegate clears the delegation; wallets should surface active delegations and their revocation prominently.